Verify GitHub webhook signatures (+ replay protection)

[nisshchayarathi]

Summary
Harden /api/webhooks/github by verifying signatures and rejecting replayed events.

Acceptance criteria

• Signature is validated against a secret.
• Replayed delivery IDs are rejected for a configurable TTL.

[tmdeveloper007]

Closing as stale - this issue has been open for more than 2 days with no linked pull request and no recent activity. If this is still needed, please reopen with a clear implementation plan.

[tmdeveloper007]

This issue has been open for a while without a linked pull request or recent activity. Closing as stale. If this is still relevant, please reopen with additional context.

[tmdeveloper007]

This issue has been open without a linked pull request or recent activity. Closing as stale. If this is still relevant, please reopen with additional context.

[tmdeveloper007]

This issue has been open for over a month with no linked PR or recent activity. Closing as stale. Please reopen if you are actively working on this.

[tmdeveloper007]

Closing this issue as it has been open for 38 days without a linked PR or assignee. If this is still needed, please reopen with a PR or assign a maintainer.

[github-actions]

👋 Hey @tmdeveloper007! Looks like you want to work on this issue — awesome! 🎉

We don't assign issues through comments like this. Here's how our system works:

🤖 How to Get Assigned

Comment /assign on this issue and our bot will automatically assign it to you (if you're eligible).

/assign

📋 A Few Things to Know

• You can hold a maximum of 1 open issue at a time — finish your current one before picking another.
• You can be assigned up to 4 issues per day.
• If there's no activity for 7 days, the assignment will automatically expire so others can pick it up.
• Make sure to read our CONTRIBUTING.md before you start — it covers code style, commit conventions, and the PR checklist.

Happy contributing! 🚀

GSSoC'26 · GitVerse

[tmdeveloper007]

This issue has been open for over 40 days with no linked PR and no assignee. It appears to be a backlog item that has not been prioritized. If this is still relevant, please reopen with a clear scope and assign it. Closing as stale to keep the issue tracker actionable.

[github-actions]

👋 Hey @tmdeveloper007! Looks like you want to work on this issue — awesome! 🎉

We don't assign issues through comments like this. Here's how our system works:

🤖 How to Get Assigned

Comment /assign on this issue and our bot will automatically assign it to you (if you're eligible).

/assign

📋 A Few Things to Know

• You can hold a maximum of 1 open issue at a time — finish your current one before picking another.
• You can be assigned up to 4 issues per day.
• If there's no activity for 7 days, the assignment will automatically expire so others can pick it up.
• Make sure to read our CONTRIBUTING.md before you start — it covers code style, commit conventions, and the PR checklist.

Happy contributing! 🚀

GSSoC'26 · GitVerse

[tmdeveloper007]

Hi, I've submitted a PR (#2590) that adds timestamp validation to the GitHub webhook handler to prevent replay attacks. Events older than 5 minutes are now rejected with HTTP 400. Please review.